Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
M-02·

`block.timestamp` use in dex swap deadlines may cause poor trading

Not reportedoptionsleverageblack-scholes
TL;DR

In the PositionInteractionFacet.sol contract, when executing DEX swaps, the deadline parameter is set to block.timestamp + 30 minutes:

Severity
MEDIUM
Method
MManual review
CAT.
02Section · Severity

Severity

Impact: Medium

Likelihood: Medium

03Section · Description

Description

In the PositionInteractionFacet.sol contract, when executing DEX swaps, the deadline parameter is set to block.timestamp + 30 minutes:

solidity
IV3SwapRouter.ExactOutputSingleParams memory params = IV3SwapRouter.ExactOutputSingleParams({
tokenIn: assetIn,
tokenOut: assetOut,
fee: dex.dexFee,
recipient: address(this),
deadline: block.timestamp + 30 minutes, // Unnecessary buffer
amountOut: amountOut,
amountInMaximum: amountInMaximum,
sqrtPriceLimitX96: sqrtPriceLimitX96
});

This implementation is problematic for several reasons:

  1. The 30-minute buffer is unnecessary since the transaction will be executed at the current block.timestamp anyway.
  2. This extended deadline window allows malicious MEV bots to potentially withhold the transaction and execute it at a less optimal time.
  3. This implementation doesn't provide any real protection against transaction delays since the actual execution time is determined by the network's block production.
04Section · Recommendations

Recommendations

Replace the current deadline implementation with the user input deadline.

05Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

M-02